thanhnvandClaude Opus 4.8
8c20cfde9f
Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the level it needs (packaging/levels.json is the single source of truth). Implemented now: - Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION. - Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates: project scaffold, domain-pack, gitea-workflow). - scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE; enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified: extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID. - docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER. Structure + docs only: - Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending). - Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task. Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots correctly and creates state on first run. In an adopted repo `.specify` still matches first. policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
# CASAN Docker Guide
|
|
|
|
Run the CASAN governance harness as a container against any mounted repo — no install into
|
|
the target project.
|
|
|
|
## Image: `casan-harness` (Level 1/2)
|
|
Dockerfile: [`packages/casan-devkit/Dockerfile.harness`](../../packages/casan-devkit/Dockerfile.harness).
|
|
Minimal Debian + bash + python3 + openssl + git. Ships the core harness + `bin/casan`.
|
|
|
|
### Build
|
|
```bash
|
|
V=$(cat VERSION)
|
|
docker build -f packages/casan-devkit/Dockerfile.harness -t casan-harness:$V .
|
|
```
|
|
|
|
### Run the gate on a project
|
|
```bash
|
|
docker run --rm -v "$PWD":/workspace -w /workspace casan-harness:1.0.0 gate
|
|
# (ENTRYPOINT is `casan`, so the CMD is a casan subcommand)
|
|
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 reuse
|
|
docker run --rm -v "$PWD":/workspace casan-harness:1.0.0 \
|
|
run in.txt out.txt my_step -- echo hello
|
|
```
|
|
The harness inside the image lives at `/opt/casan` (`CASAN_HARNESS_ROOT` preset); your
|
|
project is mounted at `/workspace`. Domain data is read from the mounted repo
|
|
(`apps/<project>/domain` via `CASAN_DOMAIN_ROOT`).
|
|
|
|
### With a domain root
|
|
```bash
|
|
docker run --rm -v "$PWD":/workspace -w /workspace \
|
|
-e CASAN_DOMAIN_ROOT=apps/ticketing/domain casan-harness:1.0.0 gate
|
|
```
|
|
|
|
## Notes
|
|
- **State** (`.specify/logs`, audit) is written under `/workspace` (your mounted repo), so it
|
|
persists on the host and is inspectable after the run.
|
|
- **Enforced mode:** add `-e CASAN_PROFILE=prod` (or `-e CASAN_VERIFY_STRICT=1`) to make
|
|
missing signatures fail-closed.
|
|
- **No app runtime:** this image runs the *harness*, not the OKR app. For the app, use the
|
|
project's own `Dockerfile.backend` / `Dockerfile.frontend` + `docker-compose.prod.yml`.
|
|
|
|
## Other images
|
|
| Image | Status | Notes |
|
|
|---|:--:|---|
|
|
| `casan-harness:X.Y.Z` | ✅ | this guide |
|
|
| `casan-platform:X.Y.Z` | 🟡 preview | dashboard only today; build from platform preview when needed |
|
|
| `casan-enterprise:X.Y.Z` | 📋 future | not built — governed console does not exist yet |
|
|
|
|
## Publish to Gitea container registry
|
|
See `GITEA_PACKAGE_GUIDE.md` §3 (`docker login` + `docker push` to the Gitea registry).
|